This vulnerability exists with EVERY client application. It is just much easier to obtain the applications with android(as opposed to IOS) which is the only reason i can assume Trustlook focused on android.

This isnt as much a "vulnerability" as it is a complete miss understanding of security and the technology they are using. Everything on the client side should be assumed as obtainable.